CVE-2025-67489

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-67489
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67489.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-67489
Aliases
Published
2025-12-09T20:54:23.716Z
Modified
2026-02-07T02:54:31.432217Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
Details

@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs (loadServerAction, decodeReply, decodeAction) when integrated into RSC applications that expose server function endpoints. Attackers with network access to the development server can read/modify files, exfiltrate sensitive data (source code, environment variables, credentials), or pivot to other internal services. While this affects development servers only, the risk increases when using vite --host to expose the server on all network interfaces. This issue is fixed in version 0.5.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67489.json"
}
References

Affected packages

Git / github.com/vitejs/vite-plugin-react

Affected ranges

Type
GIT
Repo
https://github.com/vitejs/vite-plugin-react
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fff018b1f4856c30cc6248f092832aaca84c4b2f

Affected versions

plugin-react-oxc@0.*
plugin-react-oxc@0.1.1
plugin-react-oxc@0.2.0
plugin-react-oxc@0.2.1
plugin-react-oxc@0.2.2
plugin-react-oxc@0.2.3
plugin-react-oxc@0.3.0
plugin-react-oxc@0.4.0
plugin-react-oxc@0.4.0-beta.0
plugin-react-oxc@0.4.1
plugin-react-oxc@0.4.2
plugin-react-oxc@0.4.3
plugin-react-swc@3.*
plugin-react-swc@3.10.0
plugin-react-swc@3.10.1
plugin-react-swc@3.10.2
plugin-react-swc@3.11.0
plugin-react-swc@3.9.0
plugin-react-swc@3.9.0-beta.0
plugin-react-swc@3.9.0-beta.2
plugin-react-swc@3.9.0-beta.3
plugin-react-swc@4.*
plugin-react-swc@4.0.0
plugin-react-swc@4.0.0-beta.0
plugin-react-swc@4.0.1
plugin-react-swc@4.1.0
plugin-react-swc@4.2.0
plugin-react-swc@4.2.1
plugin-react-swc@4.2.2
plugin-react@3.*
plugin-react@3.0.0
plugin-react@3.0.0-alpha.2
plugin-react@3.0.0-beta.0
plugin-react@3.0.1
plugin-react@3.1.0
plugin-react@3.1.0-beta.0
plugin-react@4.*
plugin-react@4.0.0
plugin-react@4.0.0-beta.0
plugin-react@4.0.0-beta.1
plugin-react@4.0.1
plugin-react@4.0.2
plugin-react@4.0.3
plugin-react@4.0.4
plugin-react@4.1.0
plugin-react@4.1.1
plugin-react@4.2.0
plugin-react@4.2.1
plugin-react@4.3.0
plugin-react@4.3.1
plugin-react@4.3.2
plugin-react@4.3.3
plugin-react@4.3.4
plugin-react@4.4.0
plugin-react@4.4.0-beta.0
plugin-react@4.4.0-beta.1
plugin-react@4.4.0-beta.2
plugin-react@4.4.1
plugin-react@4.5.0
plugin-react@4.5.1
plugin-react@4.5.2
plugin-react@4.6.0
plugin-react@4.7.0
plugin-react@5.*
plugin-react@5.0.0
plugin-react@5.0.0-beta.0
plugin-react@5.0.1
plugin-react@5.0.2
plugin-react@5.0.3
plugin-react@5.0.4
plugin-react@5.1.0
plugin-react@5.1.1
plugin-rsc@0.*
plugin-rsc@0.4.10
plugin-rsc@0.4.11
plugin-rsc@0.4.12
plugin-rsc@0.4.13
plugin-rsc@0.4.14
plugin-rsc@0.4.15
plugin-rsc@0.4.16
plugin-rsc@0.4.17
plugin-rsc@0.4.18
plugin-rsc@0.4.19
plugin-rsc@0.4.20
plugin-rsc@0.4.21
plugin-rsc@0.4.22
plugin-rsc@0.4.23
plugin-rsc@0.4.24
plugin-rsc@0.4.25
plugin-rsc@0.4.26
plugin-rsc@0.4.27
plugin-rsc@0.4.28
plugin-rsc@0.4.29
plugin-rsc@0.4.30
plugin-rsc@0.4.31
plugin-rsc@0.4.32
plugin-rsc@0.4.33
plugin-rsc@0.4.34
plugin-rsc@0.5.0
plugin-rsc@0.5.1
plugin-rsc@0.5.2
plugin-rsc@0.5.3
plugin-rsc@0.5.4
plugin-rsc@0.5.5
v3.*
v3.9.0-beta.2
v4.*
v4.0.2
v4.0.3
v4.0.4
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.4.0-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67489.json"